mcp-use - The fullstack MCP framework to develop MCP Apps for ChatGPT / Claude and MCP Servers for AI Agents.

View the source code for this module on GitHub: https://github.com/mcp-use/mcp-use/blob/main/libraries/typescript/packages/mcp-use/src/server/oauth/index.ts

These factory functions build the oauth value you pass to new MCPServer({ ... }). Each one returns an OAuthProvider (or OAuthProxy) that the server uses to verify bearer tokens, proxy .well-known metadata discovery, and extract user info onto ctx.auth. There are two integration modes:

DCR-direct providers (oauthAuth0Provider, oauthBetterAuthProvider, oauthClerkProvider, oauthKeycloakProvider, oauthSupabaseProvider, oauthWorkOSProvider, oauthCustomProvider). The MCP server proxies metadata discovery to the upstream authorization server and verifies tokens. Clients communicate directly with the upstream for authorize, token, and register.
Proxy mode (oauthProxy) for providers without Dynamic Client Registration support (Google, GitHub, Okta, Microsoft Entra ID, and enterprise IdPs). The server mediates the flow: it exposes a /register endpoint returning the configured clientId, injects clientId/clientSecret at token exchange, and passes upstream tokens through without minting its own.

All factories import from mcp-use/server.

import { oauthAuth0Provider, oauthProxy, jwksVerifier } from "mcp-use/server";

Functions

oauthAuth0Provider

Create an Auth0 OAuth provider for an MCP server.

import { oauthAuth0Provider } from "mcp-use/server"

Builds an OAuthProvider backed by Auth0. Supports zero-config setup: when config is omitted, domain falls back to MCP_USE_OAUTH_AUTH0_DOMAIN and audience falls back to MCP_USE_OAUTH_AUTH0_AUDIENCE. Throws Error if domain is missing ("Auth0 domain is required.") and throws Error if audience is missing ("Auth0 audience is required."). The config argument is Partial<Auth0ProviderConfig> and defaults to an empty object. Parameters

config
Partial<Auth0ProviderConfig>
default:"{}"
Optional Auth0 configuration. Values passed here override the corresponding environment variables.

Returns

returns
OAuthProvider

Signature

function oauthAuth0Provider(config?: Partial<Auth0ProviderConfig>): OAuthProvider

Example

import { MCPServer, oauthAuth0Provider, error, object } from "mcp-use/server"

// Zero-config: reads MCP_USE_OAUTH_AUTH0_DOMAIN and MCP_USE_OAUTH_AUTH0_AUDIENCE
const server = new MCPServer({
  name: "auth0-oauth-example",
  version: "1.0.0",
  description: "MCP server with Auth0 OAuth authentication",
  oauth: oauthAuth0Provider(),
})

server.tool(
  { name: "get-user-info", description: "Get information about the authenticated user" },
  async (_args, ctx) =>
    object({
      userId: ctx.auth.user.userId,
      email: ctx.auth.user.email,
      name: ctx.auth.user.name,
      permissions: ctx.auth.permissions,
      scopes: ctx.auth.scopes,
    }),
)

server.listen()

oauthBetterAuthProvider

Create a Better Auth OAuth provider for an MCP server.

import { oauthBetterAuthProvider } from "mcp-use/server"

Builds an OAuthProvider backed by Better Auth’s OAuth Provider plugin. The MCP server only verifies tokens and serves metadata; clients discover Better Auth’s endpoints via .well-known passthrough (/oauth2/authorize, /oauth2/token, /oauth2/register, /jwks) and talk to Better Auth directly. authURL falls back to MCP_USE_OAUTH_BETTER_AUTH_URL. Throws Error if authURL is missing ("Better Auth authURL is required."). The config argument is Partial<BetterAuthProviderConfig> and defaults to an empty object. Parameters

config
Partial<BetterAuthProviderConfig>
default:"{}"
Optional Better Auth configuration. Values passed here override the corresponding environment variables.

Returns

returns
OAuthProvider

Signature

function oauthBetterAuthProvider(config?: Partial<BetterAuthProviderConfig>): OAuthProvider

Example

import { MCPServer, oauthBetterAuthProvider, object } from "mcp-use/server"

const server = new MCPServer({
  name: "better-auth-oauth-example",
  version: "1.0.0",
  description: "MCP server with Better Auth OAuth authentication",
  oauth: oauthBetterAuthProvider({
    authURL: "http://localhost:3000/api/auth",
  }),
})

oauthClerkProvider

Create a Clerk OAuth provider for an MCP server.

import { oauthClerkProvider } from "mcp-use/server"

Builds an OAuthProvider backed by Clerk. Uses Dynamic Client Registration: clients register themselves with Clerk (enable DCR in the Clerk Dashboard under Configure, OAuth Applications, Dynamic Client Registration), and the MCP server only verifies Clerk-issued tokens. frontendApiUrl falls back to MCP_USE_OAUTH_CLERK_FRONTEND_API_URL. Throws Error if frontendApiUrl is missing ("Clerk frontendApiUrl is required."). The config argument is Partial<ClerkProviderConfig> and defaults to an empty object. Parameters

config
Partial<ClerkProviderConfig>
default:"{}"
Optional Clerk configuration. Values passed here override the corresponding environment variables.

Returns

returns
OAuthProvider

Signature

function oauthClerkProvider(config?: Partial<ClerkProviderConfig>): OAuthProvider

Example

import { MCPServer, oauthClerkProvider, object } from "mcp-use/server"

// Zero-config: reads MCP_USE_OAUTH_CLERK_FRONTEND_API_URL
const server = new MCPServer({
  name: "clerk-oauth-example",
  version: "1.0.0",
  description: "MCP server with Clerk OAuth authentication",
  oauth: oauthClerkProvider(),
})

server.tool(
  { name: "get-user-info", description: "Get information about the authenticated user" },
  async (_args, ctx) =>
    object({
      userId: ctx.auth.user.userId,
      email: ctx.auth.user.email,
      name: ctx.auth.user.name,
    }),
)

server.listen()

oauthKeycloakProvider

Create a Keycloak OAuth provider for an MCP server.

import { oauthKeycloakProvider } from "mcp-use/server"

Builds an OAuthProvider backed by Keycloak using its native Dynamic Client Registration (RFC 7591). serverUrl falls back to MCP_USE_OAUTH_KEYCLOAK_SERVER_URL, realm falls back to MCP_USE_OAUTH_KEYCLOAK_REALM, and audience falls back to MCP_USE_OAUTH_KEYCLOAK_AUDIENCE. Throws Error if serverUrl is missing ("Keycloak serverUrl is required.") and throws Error if realm is missing ("Keycloak realm is required."). The config argument is Partial<KeycloakProviderConfig> and defaults to an empty object. Parameters

config
Partial<KeycloakProviderConfig>
default:"{}"
Optional Keycloak configuration. Values passed here override the corresponding environment variables.

Returns

returns
OAuthProvider

Signature

function oauthKeycloakProvider(config?: Partial<KeycloakProviderConfig>): OAuthProvider

Example

import { MCPServer, oauthKeycloakProvider, object } from "mcp-use/server"

const server = new MCPServer({
  name: "keycloak-oauth-example",
  version: "1.0.0",
  description: "MCP server with Keycloak OAuth authentication (DCR)",
  oauth: oauthKeycloakProvider({
    serverUrl: "http://localhost:8080",
    realm: "demo",
  }),
})

server.tool(
  { name: "get-user-info", description: "Return identity info extracted from the Keycloak access token" },
  async (_args, ctx) =>
    object({
      userId: ctx.auth.user.userId,
      username: ctx.auth.user.username,
      email: ctx.auth.user.email,
      roles: ctx.auth.user.roles,
    }),
)

oauthSupabaseProvider

Create a Supabase OAuth provider for an MCP server.

import { oauthSupabaseProvider } from "mcp-use/server"

Builds an OAuthProvider backed by Supabase’s OAuth 2.1 server. Supports zero-config setup: projectId falls back to MCP_USE_OAUTH_SUPABASE_PROJECT_ID, supabaseUrl falls back to MCP_USE_OAUTH_SUPABASE_URL, and jwtSecret falls back to MCP_USE_OAUTH_SUPABASE_JWT_SECRET. The hosted URL is derived as https://${projectId}.supabase.co unless supabaseUrl is set (use supabaseUrl for local or self-hosted instances, e.g. http://localhost:54321). Throws Error if neither projectId nor supabaseUrl is resolved ("Supabase projectId or supabaseUrl is required."). The config argument is Partial<SupabaseProviderConfig> and defaults to an empty object. Parameters

config
Partial<SupabaseProviderConfig>
default:"{}"
Optional Supabase configuration. Values passed here override the corresponding environment variables.

Returns

returns
OAuthProvider

Signature

function oauthSupabaseProvider(config?: Partial<SupabaseProviderConfig>): OAuthProvider

Example

import { MCPServer, oauthSupabaseProvider } from "mcp-use/server"

// Zero-config: reads MCP_USE_OAUTH_SUPABASE_PROJECT_ID
const server = new MCPServer({
  name: "supabase-oauth-example",
  version: "1.0.0",
  description: "MCP server with Supabase OAuth authentication",
  oauth: oauthSupabaseProvider(),
})

oauthWorkOSProvider

Create a WorkOS AuthKit OAuth provider for an MCP server.

import { oauthWorkOSProvider } from "mcp-use/server"

Builds an OAuthProvider backed by WorkOS AuthKit using Dynamic Client Registration. Clients register themselves with WorkOS (enable DCR in the WorkOS Dashboard under Connect, Configuration), and the MCP server only verifies WorkOS-issued tokens. subdomain falls back to MCP_USE_OAUTH_WORKOS_SUBDOMAIN. Throws Error if subdomain is missing ("WorkOS subdomain is required."). The config argument is Partial<WorkOSProviderConfig> and defaults to an empty object. Parameters

config
Partial<WorkOSProviderConfig>
default:"{}"
Optional WorkOS configuration. Values passed here override the corresponding environment variables.

Returns

returns
OAuthProvider

Signature

function oauthWorkOSProvider(config?: Partial<WorkOSProviderConfig>): OAuthProvider

Example

import { MCPServer, oauthWorkOSProvider } from "mcp-use/server"

// Zero-config: reads MCP_USE_OAUTH_WORKOS_SUBDOMAIN
const server = new MCPServer({
  name: "workos-oauth-example",
  version: "1.0.0",
  description: "MCP server with WorkOS AuthKit OAuth authentication",
  oauth: oauthWorkOSProvider(),
})

oauthCustomProvider

Create an OAuth provider for any standards-compliant authorization server.

import { oauthCustomProvider } from "mcp-use/server"

Builds an OAuthProvider from explicit endpoint URLs and a custom verifyToken function. Unlike the other factories, config is required (there are no environment-variable fallbacks). Use this for any OAuth provider that exposes standard .well-known discovery and an authorization plus token endpoint, where you supply your own token verification logic. Parameters

config
CustomProviderConfig
required
Custom provider configuration with explicit endpoints and a verifyToken function.

Returns

returns
OAuthProvider

Signature

function oauthCustomProvider(config: CustomProviderConfig): OAuthProvider

Example

import { MCPServer, oauthCustomProvider } from "mcp-use/server"

const server = new MCPServer({
  name: "my-server",
  version: "1.0.0",
  oauth: oauthCustomProvider({
    issuer: "https://oauth.example.com",
    jwksUrl: "https://oauth.example.com/.well-known/jwks.json",
    authEndpoint: "https://oauth.example.com/authorize",
    tokenEndpoint: "https://oauth.example.com/token",
    verifyToken: async (token) => {
      // Custom verification logic; return { payload }
      return { payload: {} }
    },
  }),
})

oauthProxy

Create an OAuth proxy for providers without Dynamic Client Registration.

import { oauthProxy, jwksVerifier } from "mcp-use/server"

Builds an OAuthProxy for providers that lack DCR support (Google OAuth, GitHub OAuth, Okta, Microsoft Entra ID, and enterprise IdPs). The proxy exposes a /register endpoint that returns the configured clientId, injects clientId/clientSecret at token exchange, verifies tokens via the supplied verifyToken function, and passes upstream tokens through without minting its own. scopes defaults to ["openid", "email", "profile"] and grantTypes defaults to ["authorization_code", "refresh_token"]. When getUserInfo is omitted, a default extractor reads the standard OIDC claims (sub, email, name, picture) and splits the scope claim into scopes. Throws Error if any of authEndpoint, tokenEndpoint, issuer, clientId, or verifyToken is missing. The verifyToken error message points you to jwksVerifier() for JWT/JWKS providers. Pair oauthProxy with jwksVerifier() (exported from mcp-use/server) to verify JWTs against a remote JWKS. jwksVerifier enforces the iss claim, optionally enforces aud, and throws early with a helpful message if the token is not a three-segment signed JWT (for example, when an authorize request omitted a valid audience and the provider issued an opaque token). Parameters

config
OAuthProxyConfig
required
OAuth proxy configuration including upstream endpoints, client credentials, and a verifyToken function.

Returns

returns
OAuthProxy

Signature

function oauthProxy(config: OAuthProxyConfig): OAuthProxy

Example

import { MCPServer, oauthProxy, jwksVerifier, object, error } from "mcp-use/server"

const issuer = process.env.OKTA_ISSUER!
const clientId = process.env.OKTA_CLIENT_ID!
const clientSecret = process.env.OKTA_CLIENT_SECRET

const server = new MCPServer({
  name: "okta-proxy-example",
  version: "1.0.0",
  description: "MCP server with Okta OAuth proxy authentication",
  oauth: oauthProxy({
    authEndpoint: `${issuer}/v1/authorize`,
    tokenEndpoint: `${issuer}/v1/token`,
    issuer,
    clientId,
    clientSecret,
    scopes: ["openid", "email", "profile"],
    verifyToken: jwksVerifier({
      jwksUrl: `${issuer}/v1/keys`,
      issuer,
      audience: clientId,
    }),
  }),
})

server.listen()

mountOAuthProxy

Mount CORS-free OAuth proxy routes on a Hono app.

import { mountOAuthProxy } from "mcp-use/server"

Mounts OAuth proxy routes on a Hono app so browser clients can complete OAuth flows without CORS restrictions. This is a request-forwarding utility distinct from oauthProxy (which configures the MCP server’s own auth). It registers two routes under basePath (default /oauth): GET <basePath>/metadata proxies .well-known metadata discovery (with WWW-Authenticate header discovery and standard-path fallbacks), and POST <basePath>/proxy forwards general OAuth requests such as token exchange and registration. The routes enable permissive CORS (origin: "*", methods GET, POST, OPTIONS). Returns void. The options argument defaults to an empty object. Parameters

app
Hono
required
The Hono application instance to register routes on.

options
OAuthProxyOptions
default:"{}"
Configuration options for the proxy routes.

Returns

returns
void

Signature

function mountOAuthProxy(app: Hono, options?: OAuthProxyOptions): void

Example

import { Hono } from "hono"
import { mountOAuthProxy } from "mcp-use/server"

const app = new Hono()

// Basic usage at the default /oauth base path
mountOAuthProxy(app)

// With a custom base path
mountOAuthProxy(app, {
  basePath: "/inspector/api/oauth",
})

Types

Auth0ProviderConfig

Configuration for oauthAuth0Provider.

import type { Auth0ProviderConfig } from "mcp-use/server"

Configuration for the Auth0 provider. oauthAuth0Provider accepts Partial<Auth0ProviderConfig> and fills any missing domain/audience from environment variables. Properties

domain
string
required
Auth0 tenant domain, e.g. my-tenant.auth0.com.

audience
string
required
API identifier used as the JWT aud claim.

verifyJwt
boolean
Whether to verify the JWT signature.

scopesSupported
string[]
Scopes advertised in metadata.

Signature

interface Auth0ProviderConfig {
  domain: string
  audience: string
  verifyJwt?: boolean
  scopesSupported?: string[]
}

BetterAuthProviderConfig

Configuration for oauthBetterAuthProvider.

import type { BetterAuthProviderConfig } from "mcp-use/server"

Configuration for the Better Auth provider. authURL falls back to MCP_USE_OAUTH_BETTER_AUTH_URL. The optional getUserInfo callback maps the verified JWT payload to a UserInfo object (sync or async). Note the getUserInfo parameter is typed Record<string, unknown>, which contains a curly brace; see the signature fence below. Properties

authURL
string
required
Base URL of the Better Auth OAuth server, e.g. http://localhost:3000/api/auth.

verifyJwt
boolean
Whether to verify the JWT signature.

scopesSupported
string[]
Scopes advertised in metadata.

getUserInfo
(payload) => UserInfo | Promise<UserInfo>
Optional callback mapping a verified payload to user info.

Signature

interface BetterAuthProviderConfig {
  authURL: string
  verifyJwt?: boolean
  scopesSupported?: string[]
  getUserInfo?: (payload: Record<string, unknown>) => UserInfo | Promise<UserInfo>
}

ClerkProviderConfig

Configuration for oauthClerkProvider.

import type { ClerkProviderConfig } from "mcp-use/server"

Configuration for the Clerk provider. frontendApiUrl falls back to MCP_USE_OAUTH_CLERK_FRONTEND_API_URL. Properties

frontendApiUrl
string
required
Clerk Frontend API URL, e.g. https://verb-noun-42.clerk.accounts.dev or https://clerk.yourdomain.com.

audience
string
Optional audience for JWT verification.

verifyJwt
boolean
Whether to verify the JWT signature.

scopesSupported
string[]
Scopes advertised in metadata.

Signature

interface ClerkProviderConfig {
  frontendApiUrl: string
  audience?: string
  verifyJwt?: boolean
  scopesSupported?: string[]
}

KeycloakProviderConfig

Configuration for oauthKeycloakProvider.

import type { KeycloakProviderConfig } from "mcp-use/server"

Configuration for the Keycloak provider. serverUrl falls back to MCP_USE_OAUTH_KEYCLOAK_SERVER_URL, realm to MCP_USE_OAUTH_KEYCLOAK_REALM, and audience to MCP_USE_OAUTH_KEYCLOAK_AUDIENCE. Properties

serverUrl
string
required
Keycloak base URL, e.g. https://keycloak.example.com.

realm
string
required
Keycloak realm name.

audience
string
MCP server URL used to validate the JWT aud claim (set via a Keycloak audience mapper on client scopes).

verifyJwt
boolean
Whether to verify the JWT signature.

scopesSupported
string[]
Scopes advertised in metadata.

Signature

interface KeycloakProviderConfig {
  serverUrl: string
  realm: string
  audience?: string
  verifyJwt?: boolean
  scopesSupported?: string[]
}

SupabaseProviderConfig

Configuration for oauthSupabaseProvider.

import type { SupabaseProviderConfig } from "mcp-use/server"

Configuration for the Supabase provider. Either projectId or supabaseUrl must resolve (from config or environment). projectId derives the hosted URL https://${projectId}.supabase.co; supabaseUrl overrides it for self-hosted or local instances. Properties

projectId
string
Supabase project ID used to derive the hosted URL.

supabaseUrl
string
Explicit Supabase base URL. Overrides the projectId-derived URL, e.g. http://localhost:54321.

jwtSecret
string
Optional JWT secret for legacy HS256 token verification.

verifyJwt
boolean
Whether to verify the JWT signature.

scopesSupported
string[]
Scopes advertised in metadata.

Signature

interface SupabaseProviderConfig {
  projectId?: string
  supabaseUrl?: string
  jwtSecret?: string
  verifyJwt?: boolean
  scopesSupported?: string[]
}

WorkOSProviderConfig

Configuration for oauthWorkOSProvider.

import type { WorkOSProviderConfig } from "mcp-use/server"

Configuration for the WorkOS provider. subdomain falls back to MCP_USE_OAUTH_WORKOS_SUBDOMAIN. Properties

subdomain
string
required
WorkOS AuthKit subdomain, e.g. my-company.authkit.app.

verifyJwt
boolean
Whether to verify the JWT signature.

scopesSupported
string[]
Scopes advertised in metadata.

Signature

interface WorkOSProviderConfig {
  subdomain: string
  verifyJwt?: boolean
  scopesSupported?: string[]
}

CustomProviderConfig

Configuration for oauthCustomProvider.

import type { CustomProviderConfig } from "mcp-use/server"

Configuration for an arbitrary OAuth provider. issuer, authEndpoint, tokenEndpoint, and verifyToken are required; the rest are optional. verifyToken resolves to an object containing a payload (see the signature fence for the exact type, which contains a curly brace). The optional getUserInfo callback maps a payload to a UserInfo. Properties

issuer
string
required
OAuth issuer URL.

authEndpoint
string
required
Authorization endpoint URL.

tokenEndpoint
string
required
Token endpoint URL.

verifyToken
(token) => Promise<any>
required
Function that verifies a bearer token and resolves to its decoded payload.

jwksUrl
string
JWKS endpoint URL for signature verification.

userInfoEndpoint
string
User info endpoint URL.

scopesSupported
string[]
Scopes advertised in metadata.

audience
string
Audience for JWT verification.

grantTypesSupported
string[]
Grant types advertised in metadata.

getUserInfo
(payload) => UserInfo
Optional callback mapping a verified payload to user info.

Signature

interface CustomProviderConfig {
  issuer: string
  authEndpoint: string
  tokenEndpoint: string
  verifyToken: (token: string) => Promise<any>
  jwksUrl?: string
  userInfoEndpoint?: string
  scopesSupported?: string[]
  audience?: string
  grantTypesSupported?: string[]
  getUserInfo?: (payload: any) => UserInfo
}

OAuthProxy

The proxy-mode provider returned by oauthProxy.

import type { OAuthProxy } from "mcp-use/server"

Extends OAuthProvider with proxy-specific fields for providers without DCR support. Implements the full provider interface (the getter methods plus verifyToken/getUserInfo) and adds a type discriminator, pre-registered client credentials, and optional extra authorize params. The proxy exposes a /register endpoint returning the configured clientId, injects clientId/clientSecret at token exchange, and passes upstream JWTs through without minting tokens. Properties

type
"proxy"
required
Discriminator used to detect proxy providers in the provider union.

clientId
string
required
Pre-registered OAuth client ID.

clientSecret
string
Pre-registered OAuth client secret (optional for public clients).

extraAuthorizeParams
Record<string, string>
Extra parameters appended to authorize requests.

Signature

interface OAuthProxy extends OAuthProvider {
  type: "proxy"
  clientId: string
  clientSecret?: string
  extraAuthorizeParams?: Record<string, string>
}

OAuthProxyConfig

Configuration for oauthProxy.

import type { OAuthProxyConfig } from "mcp-use/server"

Configuration for creating an OAuth proxy. authEndpoint, tokenEndpoint, issuer, clientId, and verifyToken are required. scopes defaults to ["openid", "email", "profile"] and grantTypes defaults to ["authorization_code", "refresh_token"] inside oauthProxy. The verifyToken field is a VerifyToken function that resolves to an object with a payload (see the signature fence for the exact type, which contains a curly brace). When getUserInfo is omitted, standard OIDC claims are extracted. Properties

authEndpoint
string
required
Upstream authorization endpoint URL, e.g. https://accounts.google.com/o/oauth2/v2/auth.

tokenEndpoint
string
required
Upstream token endpoint URL, e.g. https://oauth2.googleapis.com/token.

issuer
string
required
Token issuer, used in metadata and (when paired with jwksVerifier) enforced as the iss claim.

verifyToken
VerifyToken
required
Token verification function. Use jwksVerifier() for JWT+JWKS providers, or write your own for opaque tokens.

clientId
string
required
Pre-registered OAuth client ID.

clientSecret
string
Pre-registered OAuth client secret (optional for public clients).

scopes
string[]
default:"[\"openid\", \"email\", \"profile\"]"
OAuth scopes to request.

grantTypes
string[]
default:"[\"authorization_code\", \"refresh_token\"]"
Supported grant types.

extraAuthorizeParams
Record<string, string>
Extra parameters added to authorize requests, e.g. { access_type: "offline", prompt: "consent" }.

getUserInfo
(payload) => UserInfo
Custom extractor for user info from the verified payload. Defaults to standard OIDC claims.

Signature

interface OAuthProxyConfig {
  authEndpoint: string
  tokenEndpoint: string
  issuer: string
  verifyToken: VerifyToken
  clientId: string
  clientSecret?: string
  scopes?: string[]
  grantTypes?: string[]
  extraAuthorizeParams?: Record<string, string>
  getUserInfo?: (payload: Record<string, unknown>) => UserInfo
}

OAuthProxyOptions

Options for mountOAuthProxy.

import type { OAuthProxyOptions } from "mcp-use/server"

Options for configuring the Hono OAuth proxy routes mounted by mountOAuthProxy. All fields are optional. The authenticate and validateTarget callbacks each take a Hono Context and may return a boolean or a promise of one; returning false rejects the request (401 for authenticate, 403 for validateTarget). Properties

basePath
string
default:"/oauth"
Base path for the proxy routes.

enableLogging
boolean
default:"true"
Enable request logging to the console.

authenticate
(c: Context) => Promise<boolean> | boolean
Optional request authentication. Return false to reject with 401.

validateTarget
(targetUrl: string, c: Context) => Promise<boolean> | boolean
Optional check that the target URL is allowed. Return false to reject with 403.

Signature

interface OAuthProxyOptions {
  basePath?: string
  enableLogging?: boolean
  authenticate?: (c: Context) => Promise<boolean> | boolean
  validateTarget?: (targetUrl: string, c: Context) => Promise<boolean> | boolean
}

​Functions

​oauthAuth0Provider

​oauthBetterAuthProvider

​oauthClerkProvider

​oauthKeycloakProvider

​oauthSupabaseProvider

​oauthWorkOSProvider

​oauthCustomProvider

​oauthProxy

​mountOAuthProxy

​Types

​Auth0ProviderConfig

​BetterAuthProviderConfig

​ClerkProviderConfig

​KeycloakProviderConfig

​SupabaseProviderConfig

​WorkOSProviderConfig

​CustomProviderConfig

​OAuthProxy

​OAuthProxyConfig

​OAuthProxyOptions

Functions

oauthAuth0Provider

oauthBetterAuthProvider

oauthClerkProvider

oauthKeycloakProvider

oauthSupabaseProvider

oauthWorkOSProvider

oauthCustomProvider

oauthProxy

mountOAuthProxy

Types

Auth0ProviderConfig

BetterAuthProviderConfig

ClerkProviderConfig

KeycloakProviderConfig

SupabaseProviderConfig

WorkOSProviderConfig

CustomProviderConfig

OAuthProxy

OAuthProxyConfig

OAuthProxyOptions